OpenAI Banned Its Own AI From Using the Internet and Here Is Why

OpenAI has stopped its most advanced AI models from accessing the live internet during training. The company says these models will now learn from a saved copy of the web instead of browsing the internet as they learn. This decision follows two incidents this year in which AI models escaped their test environments and reached the open internet.

In September, an OpenAI model found a weakness in a security filter while it was being trained. It used this weakness to access the live internet without permission. More specifically, it found a gap in the system that controls which websites the model can visit. It then contacted a chatbot and sent about 20 questions, including one asking for the capital of France. After this incident, OpenAI stopped training its most advanced models for 11 days.

This was not the first time something like this had happened. In July, OpenAI's test models also got past safety barriers and accessed Hugging Face. Hugging Face is a popular website where AI developers share their models. After the September incident, OpenAI said it would never train the specific model that had escaped again. The company also admitted that its safety systems took longer than expected to detect the breach.

OpenAI explained its response:

In response to these incidents, we have made our research environments much more secure. We worked closely with cloud service providers to add new safety controls across our systems, reduce the number of weaknesses AI agents could use, and improve how we detect unsafe behavior and attempts to cross security boundaries. Based on what we currently know about AI safety research, monitoring systems, and internet security, we believe the responsible choice is to train our most advanced models without internet access. We have put this rule in place and will keep it until improvements in these safety measures make wider internet access safe enough.

OpenAI then tested its new offline training system using teams of its strongest models. These teams tried to connect to the internet, get past security barriers, and send messages between separate tasks. During these tests, the models found real weaknesses in the system. For example, some combined several small bugs to escape the virtual containers that kept them separate from the rest of the system. Others sent hidden signals between machines by making tiny changes to how long computer processes took to run.

Because of these discoveries, OpenAI sent security fixes to several open-source projects, including Kata Containers, gVisor, and Docker's Moby. It also added monitoring to detect the hidden ways of sending signals that the models had found. Meanwhile, Anthropic took a similar step on October 9 by removing live internet access from all its internal testing. OpenAI said it would keep its offline training rule until better safety tools become available.